OpenCode-style TUI, model probing, sandboxed auto approval

- TUI: centered home screen with logo, boxed input with mode line, sidebar
  (>=120 cols), Ctrl+P palette, Tab Build/Plan, Shift+Tab approval cycle,
  mouse (cards, cursor, pickers, wheel), /sidebar /mouse /approval
- /models probing: key check on entry (401 re-asks), API models in /model
- Shell sandbox in C: Linux Landlock (writes limited to workspace/tmp,
  ABI>=4 blocks TCP), macOS sandbox_init, rules fallback elsewhere
- Approval modes ask/auto/yolo (default auto); read-only command whitelist;
  ask to rerun outside the sandbox when a command looks blocked
- Upgradable bootstrap scripts (git pull --ff-only, rebuild, reinstall) and
  cst-agent-update; cst-agent --version
- tests: test_sandbox, test_models

scripts/bootstrap_termux.sh

@@ -1,26 +1,90 @@
 #!/data/data/com.termux/files/usr/bin/bash
-# One-shot: clone, build and install CST-Agent on Android Termux.
+# Install or upgrade CST-Agent on Android Termux. Safe to rerun: an existing
+# checkout is fast-forwarded, rebuilt and reinstalled.
+#
+#   bootstrap_termux.sh [DIR] [--no-pull]
+#   cst-agent-update            (installed by this script; same as rerunning it)
 set -euo pipefail
 
-REPO_URL="${CST_AGENT_REPO:-https://git.whcself.xyz/WHC/CST-agent.git}"
-DIR="${1:-CST-agent}"
+main() {
+  local repo_url="${CST_AGENT_REPO:-https://git.whcself.xyz/WHC/CST-agent.git}"
+  local dir="" pull=1 changed=0 arg
+  for arg in "$@"; do
+    case "$arg" in
+    --no-pull) pull=0 ;;
+    --rebuilt) changed=1 ;; # internal: re-exec after a pull
+    -h | --help)
+      sed -n '2,6p' "$0"
+      return 0
+      ;;
+    *) dir="$arg" ;;
+    esac
+  done
+  if [[ -z "$dir" ]]; then
+    if [[ -n "${CST_AGENT_DIR:-}" ]]; then
+      dir="$CST_AGENT_DIR"
+    elif [[ -f Makefile && -f src/main.c && -d .git ]]; then
+      dir="$(pwd)"
+    else
+      dir="$HOME/CST-agent"
+    fi
+  fi
 
-echo "==> Termux packages"
-pkg install -y git clang make pkg-config binutils libcurl ncurses
+  echo "==> Termux packages"
+  local need=() p
+  for p in git clang make pkg-config binutils libcurl ncurses; do
+    dpkg -s "$p" >/dev/null 2>&1 || need+=("$p")
+  done
+  if ((${#need[@]})); then
+    pkg install -y "${need[@]}"
+  else
+    echo "    all present"
+  fi
 
-if [[ ! -f "$DIR/Makefile" ]]; then
-  echo "==> git clone $REPO_URL -> $DIR"
-  git clone "$REPO_URL" "$DIR"
-fi
-cd "$DIR"
+  local old="" new=""
+  if [[ ! -f "$dir/Makefile" ]]; then
+    echo "==> git clone $repo_url -> $dir"
+    git clone "$repo_url" "$dir"
+    changed=1
+  elif ((pull)); then
+    old="$(git -C "$dir" rev-parse HEAD)"
+    if git -C "$dir" diff --quiet && git -C "$dir" diff --cached --quiet; then
+      echo "==> git pull ($dir)"
+      git -C "$dir" pull --ff-only
+    else
+      echo "warning: $dir has local changes; skipping git pull" >&2
+    fi
+    new="$(git -C "$dir" rev-parse HEAD)"
+    if [[ "$old" != "$new" ]]; then
+      echo "    $(git -C "$dir" log --oneline "$old..$new" | wc -l) new commit(s)"
+      # The script itself may have changed: continue with the new version.
+      exec bash "$dir/scripts/bootstrap_termux.sh" "$dir" --no-pull --rebuilt
+    fi
+  fi
+  cd "$dir"
+  dir="$(pwd)"
 
-echo "==> build"
-make -j"$(nproc 2>/dev/null || echo 4)"
-make check || echo "warning: some tests failed (see above)"
+  echo "==> build"
+  local jobs
+  jobs="$(nproc 2>/dev/null || echo 4)"
+  if ((changed)); then
+    make clean >/dev/null 2>&1 || true
+  fi
+  make -j"$jobs"
+  make check >/dev/null 2>&1 || echo "warning: some tests failed (run 'make check')"
 
-echo "==> install to $PREFIX/bin"
-make install
+  echo "==> install to $PREFIX/bin"
+  make install
+  cat >"$PREFIX/bin/cst-agent-update" <<EOF
+#!$PREFIX/bin/bash
+exec bash "$dir/scripts/bootstrap_termux.sh" "$dir" "\$@"
+EOF
+  chmod 0755 "$PREFIX/bin/cst-agent-update"
 
-echo
-echo "OK: run 'cst-agent' inside a project directory."
-echo "The first start asks for the provider and its API key and saves them."
+  echo
+  echo "OK: $("$PREFIX/bin/cst-agent" --version)"
+  echo "Run 'cst-agent' inside a project directory; upgrade later with 'cst-agent-update'."
+  echo "The first start asks for the provider and its API key and saves them."
+}
+
+main "$@"